> ## Documentation Index
> Fetch the complete documentation index at: https://docs.autosana.ai/llms.txt
> Use this file to discover all available pages before exploring further.

# Network Allowlist

> Source IPs to allowlist for firewalls in front of your apps or APIs

If your test target or the APIs your [hooks](/hooks) call sit behind a firewall, allowlist Autosana's source IPs. The current list is at `GET /api/v1/network/allowlist`.

<Tip>
  If your web app is not reachable from public Autosana runner IPs because it lives inside a Tailscale tailnet, use the [Tailscale integration](/private-network) instead of IP allowlisting.
</Tip>

```bash theme={null}
curl -fsSL https://backend.autosana.ai/api/v1/network/allowlist \
  -H "X-API-Key: YOUR_API_KEY"
```

Grab `YOUR_API_KEY` from [Settings → Integrations](https://autosana.ai/settings?tab=integrations).

```json theme={null}
{
  "hook_runners": ["<ip>"],
  "flow_runners": {
    "ios":     ["<ip>", "..."],
    "android": ["<ip>", "..."],
    "web":     ["<ip>", "..."],
    "virtual_runners": {
      "ios_simulators":    ["<ip>", "..."],
      "android_emulators": ["<ip>", "..."],
      "web_browsers":      ["<ip>", "..."]
    },
    "real_device_runners": ["<cidr>", "..."]
  },
  "documentation_url": "https://docs.autosana.ai/network-allowlist"
}
```

* **`hook_runners`** — source IPs for HTTP traffic from [hook scripts](/hooks). Stable; rarely changes. Allowlist on firewalls protecting APIs your hooks call.
* **`flow_runners.virtual_runners`** — source IPs for iOS simulators, Android emulators, and web browsers hosted by Autosana.
* **`flow_runners.real_device_runners`** — shared source CIDRs for iOS and Android real devices. Allowlist these ranges when running on real devices.

Runner ranges can change as Autosana scales or its infrastructure providers update their networks.

## Webhooks

Run-result [webhooks](/webhooks), for every platform, are sent from the `flow_runners.virtual_runners.web_browsers` IPs. Allowlist those on the endpoint that receives them. The `ios_simulators` and `android_emulators` IPs never send webhooks.

The **Test** button on a webhook in **Settings > Integrations > Webhooks** sends from Autosana's API, whose IPs are not in this list. If your endpoint allowlists only the runner IPs, test webhooks can be blocked while real deliveries arrive.

## Staying in sync

We don't notify when IPs change — the endpoint is the source of truth. Two patterns:

1. **Poll from firewall-as-code** (Terraform, Cloudflare Worker, CI cron). The endpoint sends `Cache-Control: max-age=300`, so daily polling is cheap.
2. **Manual refresh.** Pull once a month, paste into your firewall.

If hooks start returning 401/403 or flows hit connection errors against your test target, your allowlist is likely stale — pull the endpoint and diff.
If run-result webhooks stop arriving at a firewalled endpoint, do the same.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.